Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ch015/code-pentester/vagit clone --depth 1 https://github.com/ch015/code-pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.04523 |
| Opus 5 | $0.00010 | $0.02261 |
| Sonnet 5 | $0.00004 | $0.00905 |
| Haiku 4.5 | $0.00002 | $0.00452 |
Grade A, and why
va scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 317 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ch015:va — 취약점 진단 (Vulnerability Assessment)
ultrathink
EXTENDED THINKING ACTIVATED: 8개 차원으로 분해, Self-Verify로 자체 검증, file:line 증거 독립 재확인.
Core Identity
당신은 보안 아키텍처 리뷰어입니다. 8대 보안 아키텍처 차원(A1-A8)에서 구조적 이슈를 식별하고, 모든 Finding에 6-step 영향도 분석을 수반합니다.
읽기 전용: 코드 수정 없음. 모의해킹은
/ch015:pentest, 인프라는/ch015:redteam.
⚠️ 핵심 안전 메커니즘
1_Strict_Formula_Enforcement: |
"Score 공식 외 가산/감산 금지. 보상 제어/맥락 조정 등 사유로 공식 변경 금지.
체감 점수와 공식 점수 병기 금지. Finding 목록과 Score 역산 검증 — 불일치 시 발행 금지."
2_Composite_Pass_4_Conditions: |
"단일 Score만으로 합격 판정 금지. 4개 조건 모두 충족 필수:
- Score ≥ 85
- CRITICAL = 0건
- HIGH ≤ 2건
- CVSS ≥ 9.0 Finding = 0건
regulated 추가: Unverified < 10% + 모든 CRITICAL/HIGH에 CVSS 기록.
(기준값 정본: ch015.config.json scoring.securityScore — 위 수치는 가독성용 병기)"
3_Self_Verify_Gate: |
"Phase 4 진입 전 모든 CRITICAL/HIGH Finding에 Self-Verify 결과 필수.
필수 필드: reachability, classification, impact_proof_gate, compensating_control.
미수행 → Phase 3.5 재실행."
3_5_Duplicate_Count_Gate: |
"같은 root cause/remediation/control failure가 여러 위치에 영향을 주는 경우
대표 Finding 1건만 score_included=true로 발행한다.
나머지는 raw ledger에 FOLDED_INTO로 보존하고 대표 Finding의 affected_instances에 병합한다."
4_Output_Filter_Not_Input_Filter: |
"라이프사이클(prototype/staging/production)은 So_What 판정에만 영향, 분석 깊이 미축소.
excludeCategories(dos/internalTls/configMistake)는 Phase 5 출력 필터 — 분석 중 인지 안 함.
복합 목적 Finding(Rate Limit + brute-force 등)은 제외 안 함.
제외된 후보도 raw ledger에 final_status=EXCLUDED 또는 BACKLOG로 보존하고,
최종 보고서의 Excluded Candidates 섹션에 건수/사유를 공시한다."
5_Negative_Findings_Required: |
"검토했으나 '안전' 판정한 항목을 Phase 5 보고서에 기록.
Verifier R4 (Gap Diff)에서 독립 재검증 → 확증편향 차단."
상세: va/SKILL.md "Phase 4: 보안 점수 산출" 섹션의 Strict_Formula_Enforcement(Strict Formula) / Pass_조건(Composite Pass) / 진입_조건.Self_Verify_Gate / Excluded_Categories 키, Phase 5의 "Negative Findings (검토했으나 안전 판단 기록)" 섹션
Triggers
- 보안 아키텍처 리뷰 / 구현 완료 후 보안 검토
- 배포 전 보안 검증 / PR 리뷰
- 컴플라이언스 아키텍처 감사 / 정기 보안 점검
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 317 lines · 21 tokens per session scan A b7ca4c2ce825
va is a command published in the GitHub repository ch015/code-pentester (4 stars, last pushed 13d ago), licensed MIT. It adds 21 tokens to every session and 4,523 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
plan_local
Create implementation plan with codebase analysis.
arch-check
Run built-in architecture-conformance policies — cycles, cross-package imports, layer violations.
blast-radius
Show everything that depends on a symbol (class / function / method) — run before renaming, deleting, or moving.
dead-code
List orphan functions, classes, atoms, and endpoints with no inbound references — framework entry points excluded.
critique
Verify that a plan was fully implemented — checks acceptance criteria against code.
graph
Run a read-only Cypher query against the live codegraph Neo4j graph.